NIS2 for food production, processing and distribution
Industrial food production, processing and wholesale distribution are in NIS2 scope. A cyber incident in a plant or a cold-chain warehouse stops deliveries within hours, and many food companies are medium-sized family businesses without a large security team.
In short: Food businesses engaged in industrial production, processing or wholesale distribution are “other critical” entities under NIS2 when they are at least medium-sized, and usually important entities. Retail and catering are not covered by this sector. Secrato gives a clear path from CyFun® BASIC to IMPORTANT or ISO/IEC 27001, with production sites, risks and suppliers on one record.
Food is a critical sector under NIS2
NIS2 Annex II uses the definition of a food business from the General Food Law, limited to wholesale distribution and industrial production and processing. Food is also one of the sectors under the CER Directive, so some food companies can be designated as critical entities and become essential under NIS2. Check your scope →
Keep production lines and deliveries running
Lines, plants and warehouses on one record
Map plants, production lines, warehouses and the systems behind them, such as ERP, MES and temperature monitoring, and link each one to its risks, controls and owners.
Ready for the incident that stops the line
Plan and rehearse the response to ransomware or an outage, keep incident records ready for the 24-hour early warning, and record what you learn as evidence for supervisors and customers.
Ingredients, packaging, logistics and IT
Keep suppliers of ingredients, packaging, logistics and IT in one register, send security questionnaires, and answer the questions your retail customers ask you.
BUILT FROM BELGIUM
What applies to food companies in Belgium and the Netherlands
Belgian food companies register with the CCB via Safeonweb@Work and can use CyFun® or ISO/IEC 27001 to show the NIS2 measures. Dutch food companies in scope register with the NCSC via MijnNCSC under the Cyberbeveiligingswet. Companies designated as critical entities follow the national CER rules as well.
Secrato is built in Belgium and hosted in a Tier IV data centre in Antwerp. Start with the free ransomware first 72 hours checklist or the free NIS2 Starter.
Common questions
Are food companies in scope of NIS2?
Yes, food businesses engaged in wholesale distribution and industrial production and processing, when they are at least medium-sized: 50 or more staff, or turnover and balance sheet both above €10 million. They are generally important entities.
Are supermarkets and restaurants covered?
Not by the food sector of NIS2, which is limited to wholesale distribution and industrial production and processing. Retail chains can still be covered through another activity or a national designation.
Can a food company become an essential entity?
Yes. Food is a sector under the CER Directive, and entities designated as critical under CER are essential entities under NIS2, regardless of size.
Where should a medium-sized food company start?
Check your scope, register with your national authority, and start with a recognised baseline. In Belgium you can begin free with the NIS2 Starter on CyFun® BASIC.
See how Secrato supports NIS2 in your food business
Show us your sites and suppliers, and we will map them to NIS2 in Secrato.
